@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/shared-ts/src/signing-lanes/rotationProtocolParsers.js

@@ -1,323 +0,0 @@
-import { parseEcdsaRelayerKeyId, parseEd25519YaoSuiteId, parseLaneOperationIdempotencyKey, parseThresholdEcdsaSessionId } from "../utils/domainIds.js";
-import { requireRecord } from "../utils/validation.js";
-import { exactRecord } from "../utils/exactRecord.js";
-import { wireLiteral, wireNonEmptyArray, wireObject, wireResult, wireUnion } from "../utils/wireSchema.js";
-import { parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../passkey-custody/primitives.js";
-import { parseEvmFamilySigningKeySlotId } from "./evmFamilySigningKeySlotId.js";
-import { parseSdkEcdsaDerivationThresholdKeyId } from "../threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaServerGeneration } from "../utils/ecdsaCapabilityActivation.js";
-import { parseNearEd25519SigningKeyId } from "../utils/registrationIds.js";
-import { parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseSigningWorkerParticipantId, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId } from "./participants.js";
-import { digest, digestString, laneEnrollmentId, laneOperationId, laneParticipantBindingDigest, laneShareEpoch, materialActivation, materialActivationId, parseAuthorization, parseLaneKind, requiredInteger, requiredString, signingLaneId, walletId, walletKeyId } from "./rotationWireFields.js";
-import { parseOwnerLaneParticipantContinuityV1 } from "./ownerContinuity.js";
-//#region ../shared-ts/src/signing-lanes/rotationProtocolParsers.ts
-const hpkePublicKey = /* @__PURE__ */ wireResult(parseHpkePublicKeyB64u);
-const hpkePublicKeyDigest = /* @__PURE__ */ wireResult(parseSigningWorkerRecipientKeyDigestB64u);
-const signingWorkerRecipientKeyId = /* @__PURE__ */ wireResult(parseSigningWorkerRecipientKeyId);
-const laneHolderParticipantId = /* @__PURE__ */ wireResult(parseLaneHolderParticipantId);
-const signingWorkerParticipantId = /* @__PURE__ */ wireResult(parseSigningWorkerParticipantId);
-const laneOperationIdempotencyKey = /* @__PURE__ */ wireResult(parseLaneOperationIdempotencyKey);
-const ed25519YaoSuiteId = /* @__PURE__ */ wireResult(parseEd25519YaoSuiteId);
-function sourceKind(expected) {
-	return (raw, label) => {
-		if (raw !== expected) throw new Error(`${label} must be ${expected}`);
-		return expected;
-	};
-}
-const participantBindingDigestString = laneParticipantBindingDigest;
-function ownerLaneProtocolSourceV1() {
-	return wireObject({
-		sourceKind: sourceKind("owner_registration"),
-		laneId: signingLaneId,
-		laneKind: wireLiteral("owner_passkey", "owner_email_otp"),
-		laneShareEpoch,
-		revocationEpoch: requiredInteger,
-		ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1,
-		participantBindingDigestB64u: participantBindingDigestString,
-		materialActivation
-	});
-}
-function provisionedLaneProtocolSourceV1() {
-	return wireObject({
-		sourceKind: sourceKind("provisioned_lane"),
-		laneId: signingLaneId,
-		laneKind: wireLiteral("linked_device", "delegated_execution", "recovery", "break_glass"),
-		laneShareEpoch,
-		revocationEpoch: requiredInteger,
-		holderParticipantId: laneHolderParticipantId,
-		signingWorkerParticipantId,
-		signingWorkerRecipientKeyId,
-		participantBindingDigestB64u: participantBindingDigestString,
-		materialActivation
-	});
-}
-function parseSource(raw, label) {
-	const record = requireRecord(raw, label);
-	const laneKind = parseLaneKind(record.laneKind, `${label}.laneKind`);
-	return laneKind === "owner_passkey" || laneKind === "owner_email_otp" ? ownerLaneProtocolSourceV1()(record, label) : provisionedLaneProtocolSourceV1()(record, label);
-}
-function laneTargetHolderV1() {
-	return wireObject({
-		participantId: laneHolderParticipantId,
-		participantBindingDigestB64u: laneParticipantBindingDigest,
-		custodyBindingId: wireResult(parseLaneHolderCustodyBindingId),
-		custodyBindingDigestB64u: wireResult(parseLaneCustodyBindingDigestB64u),
-		hpkePublicKeyB64u: hpkePublicKey,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigest
-	});
-}
-function laneTargetSigningWorkerV1() {
-	return wireObject({
-		participantId: signingWorkerParticipantId,
-		participantBindingDigestB64u: laneParticipantBindingDigest,
-		recipientKeyId: signingWorkerRecipientKeyId,
-		hpkePublicKeyB64u: hpkePublicKey,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigest
-	});
-}
-function buildLaneCreationTargetV1(args) {
-	return {
-		operation: "create_lane",
-		laneId: args.laneId,
-		laneKind: "linked_device",
-		laneShareEpoch: args.laneShareEpoch,
-		expectedTargetState: "absent"
-	};
-}
-function buildLaneRefreshTargetV1(args) {
-	return {
-		operation: "refresh_lane",
-		laneId: args.laneId,
-		laneKind: args.laneKind,
-		laneShareEpoch: args.laneShareEpoch,
-		expectedTargetState: "active_previous_epoch",
-		priorMaterialActivation: args.priorMaterialActivation
-	};
-}
-function parseTarget(raw, source, label) {
-	const record = requireRecord(raw, label);
-	if (record.operation === "create_lane") {
-		const value = exactRecord(record, [
-			"operation",
-			"laneId",
-			"laneKind",
-			"laneShareEpoch",
-			"expectedTargetState"
-		], label);
-		if (value.laneKind !== "linked_device" || value.expectedTargetState !== "absent") throw new Error(`${label} create branch has invalid target state`);
-		const target = buildLaneCreationTargetV1({
-			laneId: signingLaneId(value.laneId, `${label}.laneId`),
-			laneShareEpoch: laneShareEpoch(value.laneShareEpoch, `${label}.laneShareEpoch`)
-		});
-		if (source.laneKind === "linked_device" || source.laneKind === "delegated_execution") throw new Error(`${label} creation requires an owner-controlled source lane`);
-		if (String(target.laneId) === String(source.laneId)) throw new Error(`${label}.laneId must differ from source.laneId for creation`);
-		return target;
-	}
-	if (record.operation === "refresh_lane") {
-		const value = exactRecord(record, [
-			"operation",
-			"laneId",
-			"laneKind",
-			"laneShareEpoch",
-			"expectedTargetState",
-			"priorMaterialActivation"
-		], label);
-		if (value.expectedTargetState !== "active_previous_epoch") throw new Error(`${label} refresh branch has invalid target state`);
-		const laneId = signingLaneId(value.laneId, `${label}.laneId`);
-		if (String(laneId) !== String(source.laneId)) throw new Error(`${label}.laneId must match source.laneId for refresh`);
-		const shareEpoch = laneShareEpoch(value.laneShareEpoch, `${label}.laneShareEpoch`);
-		if (String(shareEpoch) === String(source.laneShareEpoch)) throw new Error(`${label}.laneShareEpoch must advance source.laneShareEpoch`);
-		const laneKind = parseLaneKind(value.laneKind, `${label}.laneKind`);
-		if (laneKind !== source.laneKind) throw new Error(`${label}.laneKind must match source.laneKind for refresh`);
-		if (laneKind !== "delegated_execution") return buildLaneRefreshTargetV1({
-			laneId,
-			laneKind,
-			laneShareEpoch: shareEpoch,
-			priorMaterialActivation: materialActivation(value.priorMaterialActivation, `${label}.priorMaterialActivation`)
-		});
-	}
-	throw new Error(`${label}.operation is invalid`);
-}
-function parseOperation(rawTarget, rawAuthorization, source, label) {
-	const target = parseTarget(rawTarget, source, `${label}.target`);
-	const authorization = parseAuthorization(rawAuthorization, `${label}.authorization`);
-	if (target.operation === "create_lane") {
-		if (authorization.kind !== "linked_device_enrollment") throw new Error(`${label}.authorization must be linked-device enrollment for creation`);
-		return {
-			target,
-			authorization
-		};
-	}
-	if (authorization.kind !== "owner_lane_refresh") throw new Error(`${label}.authorization must be owner refresh for refresh`);
-	return {
-		target,
-		authorization
-	};
-}
-function isParsedCreationOperation(value) {
-	return value.target.operation === "create_lane";
-}
-function parseCommonJob(record, label) {
-	const source = parseSource(record.source, `${label}.source`);
-	const targetHolder = laneTargetHolderV1()(record.targetHolder, `${label}.targetHolder`);
-	const targetSigningWorker = laneTargetSigningWorkerV1()(record.targetSigningWorker, `${label}.targetSigningWorker`);
-	const targetMaterialActivationId = materialActivationId(record.targetMaterialActivationId, `${label}.targetMaterialActivationId`);
-	if (String(targetMaterialActivationId) === String(source.materialActivation.activationId)) throw new Error(`${label}.targetMaterialActivationId must be fresh`);
-	if (record.protocolVersion !== "rotatable_signing_lane_protocol_v1") throw new Error(`${label}.protocolVersion is invalid`);
-	return {
-		operationId: laneOperationId(record.operationId, `${label}.operationId`),
-		enrollmentId: laneEnrollmentId(record.enrollmentId, `${label}.enrollmentId`),
-		idempotencyKey: laneOperationIdempotencyKey(record.idempotencyKey, `${label}.idempotencyKey`),
-		walletId: walletId(record.walletId, `${label}.walletId`),
-		walletKeyId: walletKeyId(record.walletKeyId, `${label}.walletKeyId`),
-		source,
-		targetHolder,
-		targetSigningWorker,
-		targetMaterialActivationId,
-		protocolVersion: "rotatable_signing_lane_protocol_v1",
-		expiresAtMs: requiredInteger(record.expiresAtMs, `${label}.expiresAtMs`)
-	};
-}
-function ecdsaSourceCapabilityBindingV1() {
-	return wireObject({
-		manifestId: parseEcdsaCapabilityManifestId,
-		manifestRevision: parseEcdsaCapabilityManifestRevision,
-		serverGeneration: parseEcdsaServerGeneration,
-		ecdsaThresholdKeyId: parseSdkEcdsaDerivationThresholdKeyId,
-		relayerKeyId: wireResult(parseEcdsaRelayerKeyId)
-	});
-}
-function thresholdEcdsaChainTarget() {
-	return wireUnion("kind", [wireObject({
-		kind: wireLiteral("evm"),
-		namespace: wireLiteral("eip155"),
-		chainId: requiredInteger,
-		networkSlug: requiredString
-	}), wireObject({
-		kind: wireLiteral("tempo"),
-		chainId: requiredInteger,
-		networkSlug: requiredString
-	})]);
-}
-function ecdsaTargetCapabilityBindingV1() {
-	return wireObject({
-		manifestId: parseEcdsaCapabilityManifestId,
-		manifestRevision: parseEcdsaCapabilityManifestRevision,
-		ecdsaThresholdKeyId: parseSdkEcdsaDerivationThresholdKeyId,
-		orderedThresholdSessions: wireNonEmptyArray(wireObject({
-			chainTarget: thresholdEcdsaChainTarget(),
-			thresholdSessionId: wireResult(parseThresholdEcdsaSessionId),
-			participantBindingDigestB64u: digestString
-		}))
-	});
-}
-const LANE_JOB_FIELDS = [
-	"kind",
-	"keyFamily",
-	"operationId",
-	"enrollmentId",
-	"idempotencyKey",
-	"walletId",
-	"walletKeyId",
-	"source",
-	"targetHolder",
-	"targetSigningWorker",
-	"targetMaterialActivationId",
-	"protocolVersion",
-	"expiresAtMs",
-	"target",
-	"authorization"
-];
-function parseEcdsaJob(record, label) {
-	const value = exactRecord(record, [
-		...LANE_JOB_FIELDS,
-		"evmFamilySigningKeySlotId",
-		"thresholdPublicKey33B64u",
-		"evmAddress",
-		"sourceCapability",
-		"targetCapability",
-		"sourceHolderVerifyingShare33B64u",
-		"sourceServerVerifyingShare33B64u",
-		"reshareChannelBindingDigestB64u",
-		"transcriptEncoding"
-	], label);
-	if (value.kind !== "ecdsa_additive_lane_job_v1" || value.keyFamily !== "ecdsa_secp256k1") throw new Error(`${label} kind/keyFamily is invalid`);
-	if (value.transcriptEncoding !== "ecdsa_additive_lane_transcript_v1") throw new Error(`${label}.transcriptEncoding is invalid`);
-	const common = parseCommonJob(value, label);
-	const operation = parseOperation(value.target, value.authorization, common.source, `${label}.operation`);
-	const curve = {
-		kind: "ecdsa_additive_lane_job_v1",
-		keyFamily: "ecdsa_secp256k1",
-		evmFamilySigningKeySlotId: (() => {
-			const parsed = parseEvmFamilySigningKeySlotId(value.evmFamilySigningKeySlotId);
-			if (parsed.ok) return parsed.value;
-			throw new Error(`${label}.evmFamilySigningKeySlotId is invalid`);
-		})(),
-		thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(value.thresholdPublicKey33B64u),
-		evmAddress: requiredString(value.evmAddress, `${label}.evmAddress`),
-		sourceCapability: ecdsaSourceCapabilityBindingV1()(value.sourceCapability, `${label}.sourceCapability`),
-		targetCapability: ecdsaTargetCapabilityBindingV1()(value.targetCapability, `${label}.targetCapability`),
-		sourceHolderVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(value.sourceHolderVerifyingShare33B64u, `${label}.sourceHolderVerifyingShare33B64u`),
-		sourceServerVerifyingShare33B64u: parseSecp256k1CompressedPublicKeyB64u(value.sourceServerVerifyingShare33B64u, `${label}.sourceServerVerifyingShare33B64u`),
-		reshareChannelBindingDigestB64u: digest(value.reshareChannelBindingDigestB64u, `${label}.reshareChannelBindingDigestB64u`),
-		transcriptEncoding: "ecdsa_additive_lane_transcript_v1"
-	};
-	return {
-		...common,
-		...operation,
-		...curve
-	};
-}
-function parseEdJob(record, label) {
-	const value = exactRecord(record, [
-		...LANE_JOB_FIELDS,
-		"yaoRequestKind",
-		"registeredPublicKeyB64u",
-		"nearEd25519SigningKeyId",
-		"keyCreationSignerSlot",
-		"stableContextBindingB64u",
-		"yaoSuiteId",
-		"circuitDigestB64u"
-	], label);
-	if (value.kind !== "ed25519_yao_lane_job_v1" || value.keyFamily !== "ed25519") throw new Error(`${label} kind/keyFamily is invalid`);
-	const common = parseCommonJob(value, label);
-	const operation = parseOperation(value.target, value.authorization, common.source, `${label}.operation`);
-	const yaoRequestKind = requiredString(value.yaoRequestKind, `${label}.yaoRequestKind`);
-	const curve = {
-		kind: "ed25519_yao_lane_job_v1",
-		keyFamily: "ed25519",
-		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(value.registeredPublicKeyB64u),
-		nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(value.nearEd25519SigningKeyId),
-		keyCreationSignerSlot: parseKeyCreationSignerSlot(value.keyCreationSignerSlot),
-		stableContextBindingB64u: digest(value.stableContextBindingB64u, `${label}.stableContextBindingB64u`),
-		yaoSuiteId: ed25519YaoSuiteId(value.yaoSuiteId, `${label}.yaoSuiteId`),
-		circuitDigestB64u: digest(value.circuitDigestB64u, `${label}.circuitDigestB64u`)
-	};
-	if (isParsedCreationOperation(operation)) {
-		if (yaoRequestKind !== "lane_provisioning") throw new Error(`${label}.yaoRequestKind must be lane_provisioning for creation`);
-		return {
-			...common,
-			...operation,
-			yaoRequestKind,
-			...curve
-		};
-	}
-	if (yaoRequestKind !== "lane_refresh") throw new Error(`${label}.yaoRequestKind must be lane_refresh for refresh`);
-	return {
-		...common,
-		...operation,
-		yaoRequestKind,
-		...curve
-	};
-}
-function parseRotatableSigningLaneJobV1(raw, label = "laneProtocolJob") {
-	const record = requireRecord(raw, label);
-	if (record.kind === "ed25519_yao_lane_job_v1") return parseEdJob(record, label);
-	if (record.kind === "ecdsa_additive_lane_job_v1") return parseEcdsaJob(record, label);
-	throw new Error(`${label}.kind is invalid`);
-}
-const parseLaneProtocolJobV1 = parseRotatableSigningLaneJobV1;
-//#endregion
-export { parseLaneProtocolJobV1, parseRotatableSigningLaneJobV1 };
-
-//# sourceMappingURL=rotationProtocolParsers.js.map

package/dist/esm/shared-ts/src/signing-lanes/rotationWireFields.js

@@ -1,59 +0,0 @@
-import { hasWhitespaceOrControlCharacters, parseLaneEnrollmentId, parseLaneOperationId, parseLaneShareEpoch, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationId, parseMpcMaterialActivationRef, parseSigningLaneId, parseWalletId, parseWalletKeyId } from "../utils/domainIds.js";
-import { parseAuthorizedOperationId } from "../authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { wireLabeled, wireLiteral, wireObject, wireResult, wireUnion } from "../utils/wireSchema.js";
-import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
-//#region ../shared-ts/src/signing-lanes/rotationWireFields.ts
-function requiredString(raw, label) {
-	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
-	const value = raw.trim();
-	if (!value) throw new Error(`${label} is required`);
-	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
-	return value;
-}
-function requiredInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-function parseLaneKind(raw, label) {
-	switch (raw) {
-		case "owner_passkey":
-		case "owner_email_otp":
-		case "linked_device":
-		case "delegated_execution":
-		case "recovery":
-		case "break_glass": return raw;
-		default: throw new Error(`${label} must be a known signing lane kind`);
-	}
-}
-const laneOperationId = /* @__PURE__ */ wireResult(parseLaneOperationId);
-const laneEnrollmentId = /* @__PURE__ */ wireResult(parseLaneEnrollmentId);
-const walletId = /* @__PURE__ */ wireResult(parseWalletId);
-const walletKeyId = /* @__PURE__ */ wireResult(parseWalletKeyId);
-const signingLaneId = /* @__PURE__ */ wireResult(parseSigningLaneId);
-const laneShareEpoch = /* @__PURE__ */ wireResult(parseLaneShareEpoch);
-const materialActivationId = /* @__PURE__ */ wireResult(parseMpcMaterialActivationId);
-const materialActivation = /* @__PURE__ */ wireResult(parseMpcMaterialActivationRef);
-const laneParticipantBindingDigest = /* @__PURE__ */ wireResult(parseLaneParticipantBindingDigestB64u);
-const digest = /* @__PURE__ */ wireLabeled(parseDigestB64u);
-const digestString = digest;
-const authorizedOperationId = /* @__PURE__ */ wireResult(parseAuthorizedOperationId);
-function laneOperationAuthorizationBindingV1() {
-	return wireUnion("kind", [wireObject({
-		kind: wireLiteral("linked_device_enrollment"),
-		authorizedOperationId,
-		linkedDeviceEnrollmentId: wireResult(parseLinkedDeviceEnrollmentId),
-		linkedDevicePermissionDigestB64u: digestString
-	}), wireObject({
-		kind: wireLiteral("owner_lane_refresh"),
-		authorizedOperationId,
-		ownerLaneRefreshDigestB64u: digestString
-	})]);
-}
-function parseAuthorization(raw, label) {
-	return laneOperationAuthorizationBindingV1()(raw, label);
-}
-//#endregion
-export { digest, digestString, laneEnrollmentId, laneOperationId, laneParticipantBindingDigest, laneShareEpoch, materialActivation, materialActivationId, parseAuthorization, parseLaneKind, requiredInteger, requiredString, signingLaneId, walletId, walletKeyId };
-
-//# sourceMappingURL=rotationWireFields.js.map

package/dist/types/shared-ts/src/signing-lanes/participantDigest.typecheck.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=participantDigest.typecheck.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotation.typecheck.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=rotation.typecheck.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationDigests.d.ts

@@ -1,13 +0,0 @@
-import { type DigestB64u } from '../utils/canonicalPrimitives';
-import type { AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, EcdsaServerRetirementReceiptV1, Ed25519ServerRetirementReceiptV1, Ed25519YaoLaneJobV1, LaneEnrollmentManifestV1, RevokeSigningLaneV1 } from './rotation';
-export declare function computeEd25519YaoLaneSessionDigestV1(value: Ed25519YaoLaneJobV1): Promise<string>;
-export declare function computeLaneEnrollmentManifestDigestV1(value: LaneEnrollmentManifestV1): Promise<string>;
-export declare function computeAggregateLaneActivationReceiptDigestV1(value: AggregateLaneActivationReceiptV1): Promise<string>;
-export declare function computeAggregateLaneRevocationReceiptDigestV1(value: AggregateLaneRevocationReceiptV1): Promise<string>;
-export declare function computeRevokeSigningLaneDigestV1(value: RevokeSigningLaneV1): Promise<string>;
-export declare function encodeLaneProtocolCommitReceiptV1(value: import('./rotation').LaneProtocolCommitReceiptV1): Uint8Array;
-export declare function encodeLaneHolderDeliveryReceiptV1(value: import('./rotation').LaneHolderDeliveryReceiptV1): Uint8Array;
-export declare function encodeLaneServerActivationReceiptV1(value: import('./rotation').LaneServerActivationReceiptV1): Uint8Array;
-export declare function computeEcdsaServerRetirementReceiptDigestV1(value: EcdsaServerRetirementReceiptV1): Promise<DigestB64u>;
-export declare function computeEd25519ServerRetirementReceiptDigestV1(value: Ed25519ServerRetirementReceiptV1): Promise<DigestB64u>;
-//# sourceMappingURL=rotationDigests.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationLifecycle.d.ts

@@ -1,78 +0,0 @@
-import type { LaneEnrollmentLifecycleV1, LaneProductEpochActiveV1, LaneProductEpochPendingVisibilityV1, LaneProductEpochRevocationPendingV1, LaneProductEpochRetiredV1, LaneProductEpochRevokedV1, LaneProtocolLifecycle } from './rotation';
-import type { LaneOperationId } from './ids';
-type LaneProtocolLifecycleTransitionV1 = {
-    action: 'await_protocol_commitment';
-    atMs: number;
-} | {
-    action: 'record_commit';
-    committedAtMs: number;
-    transcriptHashB64u: string;
-    protocolCommitReceiptDigestB64u: string;
-} | {
-    action: 'record_holder_delivery';
-    holderReceiptAtMs: number;
-    holderDeliveryReceiptDigestB64u: string;
-} | {
-    action: 'record_server_activation';
-    serverActivatedAtMs: number;
-    serverActivationReceiptDigestB64u: string;
-} | {
-    action: 'activate';
-    activatedAtMs: number;
-    aggregateActivationReceiptDigestB64u: string;
-} | {
-    action: 'abort_precommit';
-    abortedAtMs: number;
-    abortReason: 'cancelled' | 'expired' | 'revoked_before_commit';
-} | {
-    action: 'require_completion';
-    recoveryReason: 'exact_redelivery_required' | 'recovery_required';
-} | {
-    action: 'resume_completion';
-    atMs: number;
-};
-export declare function transitionLaneProtocolLifecycleV1(current: LaneProtocolLifecycle, transition: LaneProtocolLifecycleTransitionV1): LaneProtocolLifecycle;
-type LaneEnrollmentLifecycleTransitionV1 = {
-    action: 'mark_committed_completion_required';
-    committedChildOperationIds: readonly [LaneOperationId, ...LaneOperationId[]];
-    markedAtMs: number;
-} | {
-    action: 'mark_ready_for_visibility';
-    aggregateReceiptDigestB64u: string;
-    readyAtMs: number;
-} | {
-    action: 'activate';
-    activatedAtMs: number;
-} | {
-    action: 'cancel_precommit';
-    cancelledAtMs: number;
-} | {
-    action: 'begin_revocation';
-    reason: 'cancelled_after_commit' | 'expired_after_commit' | 'revoked_during_activation';
-    markedAtMs: number;
-} | {
-    action: 'revoke';
-    aggregateRevocationReceiptDigestB64u: string;
-    revokedAtMs: number;
-};
-export declare function transitionLaneEnrollmentLifecycleV1(current: LaneEnrollmentLifecycleV1, transition: LaneEnrollmentLifecycleTransitionV1): LaneEnrollmentLifecycleV1;
-export declare function activateLaneProductEpochV1(current: LaneProductEpochPendingVisibilityV1, args: {
-    readonly aggregateActivationReceiptDigestB64u: string;
-    readonly activatedAtMs: number;
-}): LaneProductEpochActiveV1;
-export declare function retireFencedLaneProductEpochV1(current: LaneProductEpochRevocationPendingV1, args: {
-    readonly retirementReceiptDigestB64u: string;
-    readonly retiredAtMs: number;
-}): LaneProductEpochRetiredV1;
-export declare function beginLaneProductEpochRevocationV1(current: LaneProductEpochPendingVisibilityV1 | LaneProductEpochActiveV1, args: {
-    readonly revocationEpoch: number;
-    readonly revocationReason: LaneProductEpochRevokedV1['revocationReason'];
-    readonly retirementEffectBindingDigestB64u: string;
-    readonly revocationRequestedAtMs: number;
-}): LaneProductEpochRevocationPendingV1;
-export declare function completeLaneProductEpochRevocationV1(current: LaneProductEpochRevocationPendingV1, args: {
-    readonly revocationReceiptDigestB64u: string;
-    readonly revokedAtMs: number;
-}): LaneProductEpochRevokedV1;
-export {};
-//# sourceMappingURL=rotationLifecycle.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationParsers.d.ts

@@ -1,27 +0,0 @@
-import type { AggregateLaneActivationReceiptV1, AggregateLaneRevocationReceiptV1, CommitLaneEnrollmentRevocationV1, CompleteSigningLaneRevocationV1, EcdsaServerRetirementReceiptV1, Ed25519ServerRetirementReceiptV1, LaneEnrollmentLifecycleV1, LaneEnrollmentManifestV1, LaneHolderDeliveryReceiptV1, LaneProductEpochPendingVisibilityV1, LaneProductEpochRecordV1, LaneProductEpochRevokedV1, LaneProtocolCommitReceiptV1, LaneProtocolLifecycle, LaneProtocolRecordV1, LaneRefreshPredecessorRetirementV1, LaneServerActivationReceiptV1, LaneServerRetirementReceiptV1, RevokeLaneEnrollmentV1, RevokeSigningLaneV1, RotatableSigningLaneJobV1 } from './rotation';
-export declare function parseLaneProtocolCommitReceiptV1(raw: unknown, label?: string): LaneProtocolCommitReceiptV1;
-export declare function parseLaneHolderDeliveryReceiptV1(raw: unknown, label?: string): LaneHolderDeliveryReceiptV1;
-export declare function parseLaneServerActivationReceiptV1(raw: unknown, label?: string): LaneServerActivationReceiptV1;
-export declare function parseLaneEnrollmentManifestV1(raw: unknown, label?: string): LaneEnrollmentManifestV1;
-export declare function parseAggregateLaneActivationReceiptV1(raw: unknown, label?: string): AggregateLaneActivationReceiptV1;
-export declare function parseLaneRefreshPredecessorRetirementV1(raw: unknown, label?: string): LaneRefreshPredecessorRetirementV1;
-export declare function parseAggregateLaneRevocationReceiptV1(raw: unknown, label?: string): AggregateLaneRevocationReceiptV1;
-export declare function parseRevokeLaneEnrollmentV1(raw: unknown, label?: string): RevokeLaneEnrollmentV1;
-export declare function parseRevokeSigningLaneV1(raw: unknown, label?: string): RevokeSigningLaneV1;
-export declare function parseCompleteSigningLaneRevocationV1(raw: unknown, label?: string): CompleteSigningLaneRevocationV1;
-export declare function parseLaneProductEpochRecordV1(raw: unknown, label?: string): LaneProductEpochRecordV1;
-export declare function parseLaneProtocolLifecycleV1(raw: unknown, label?: string): LaneProtocolLifecycle;
-export declare function parseLaneEnrollmentLifecycleV1(raw: unknown, label?: string): LaneEnrollmentLifecycleV1;
-export declare function buildLaneProtocolRecordV1(args: {
-    readonly job: RotatableSigningLaneJobV1;
-    readonly lifecycle: LaneProtocolLifecycle;
-}): LaneProtocolRecordV1;
-export declare function buildAggregateLaneRevocationReceiptV1(args: Omit<AggregateLaneRevocationReceiptV1, 'kind'>): AggregateLaneRevocationReceiptV1;
-export declare function buildRevokeSigningLaneV1(args: Omit<RevokeSigningLaneV1, 'kind'>): RevokeSigningLaneV1;
-export declare function buildCommitLaneEnrollmentRevocationV1(args: Omit<CommitLaneEnrollmentRevocationV1, 'kind'>): CommitLaneEnrollmentRevocationV1;
-export declare function buildLaneProductEpochPendingVisibilityV1(args: Omit<LaneProductEpochPendingVisibilityV1, 'kind' | 'state'>): LaneProductEpochPendingVisibilityV1;
-export declare function buildLaneProductEpochRevokedV1(args: Omit<LaneProductEpochRevokedV1, 'kind' | 'state'>): LaneProductEpochRevokedV1;
-export declare function parseEcdsaServerRetirementReceiptV1(raw: unknown, label?: string): EcdsaServerRetirementReceiptV1;
-export declare function parseEd25519ServerRetirementReceiptV1(raw: unknown, label?: string): Ed25519ServerRetirementReceiptV1;
-export declare function parseLaneServerRetirementReceiptV1(raw: unknown, label?: string): LaneServerRetirementReceiptV1;
-//# sourceMappingURL=rotationParsers.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationProtocolParsers.d.ts

@@ -1,6 +0,0 @@
-import type { EcdsaAdditiveLaneHolderRoundV1, LaneHolderPackageWireV1, RotatableSigningLaneJobV1 } from './rotation';
-export declare function parseRotatableSigningLaneJobV1(raw: unknown, label?: string): RotatableSigningLaneJobV1;
-export declare const parseLaneProtocolJobV1: typeof parseRotatableSigningLaneJobV1;
-export declare function parseLaneHolderPackageWireV1(raw: unknown, label?: string): LaneHolderPackageWireV1;
-export declare function parseEcdsaAdditiveLaneHolderRoundV1(raw: unknown, label?: string): EcdsaAdditiveLaneHolderRoundV1;
-//# sourceMappingURL=rotationProtocolParsers.d.ts.map

package/dist/types/shared-ts/src/signing-lanes/rotationWireFields.d.ts

@@ -1,20 +0,0 @@
-import { type MpcMaterialActivationRef } from '../utils/domainIds';
-import { type WireParser } from '../utils/wireSchema';
-import type { SigningLaneKind } from './records';
-import type { LaneOperationAuthorizationBindingV1 } from './rotation';
-export declare function requiredString(raw: unknown, label: string): string;
-export declare function requiredInteger(raw: unknown, label: string): number;
-export declare function parseLaneKind(raw: unknown, label: string): SigningLaneKind;
-export declare const laneOperationId: WireParser<import("./ids").LaneOperationId>;
-export declare const laneEnrollmentId: WireParser<import("./ids").LaneEnrollmentId>;
-export declare const walletId: WireParser<import("@server/core/registrationContracts").WalletId>;
-export declare const walletKeyId: WireParser<import("./ids").WalletKeyId>;
-export declare const signingLaneId: WireParser<import("./ids").SigningLaneId>;
-export declare const laneShareEpoch: WireParser<import("./ids").LaneShareEpoch>;
-export declare const materialActivationId: WireParser<import("../utils").MpcMaterialActivationId>;
-export declare const materialActivation: WireParser<MpcMaterialActivationRef>;
-export declare const laneParticipantBindingDigest: WireParser<import("./participants").LaneParticipantBindingDigestB64u>;
-export declare const digest: WireParser<import("../utils").DigestB64u>;
-export declare const digestString: WireParser<string>;
-export declare function parseAuthorization(raw: unknown, label: string): LaneOperationAuthorizationBindingV1;
-//# sourceMappingURL=rotationWireFields.d.ts.map

package/dist/types/shared-ts/src/wallet-recovery/recoveryCodeAttempt.d.ts

@@ -1,59 +0,0 @@
-import { type RecoveryCodeReservationId, type RecoveryCodeTransitionRejection } from './recoveryCodeReservation';
-import type { RecoveryCodeLifecycleState } from './recoveryEnvelopes';
-/**
- * One recovery attempt, with the code's lifecycle bound to its outcome.
- *
- * **A code is consumed only when the activation commits.** The three
- * transitions that enforce that already exist; what did not was anything
- * making the ordering structural. Spelling it out at each call site is a rule
- * that holds until someone adds an early return — and the failure is silent
- * and expensive: a code burned by a recovery that then failed leaves the user
- * one code poorer with nothing recovered.
- *
- * So the attempt owns the order. The caller supplies the work; this reserves
- * before it runs, consumes only if it reports a commit, and releases on every
- * other path including a throw.
- *
- * Nothing here persists. Each transition returns the next lifecycle for the
- * caller to write — this composes the decisions, it does not own the record.
- */
-export type WalletRecoveryAttemptOutcome<T> = {
-    readonly kind: 'committed';
-    readonly value: T;
-    /** Consumed. Write this before reporting success. */
-    readonly lifecycle: RecoveryCodeLifecycleState;
-} | {
-    readonly kind: 'released';
-    /** Back in the active pool: the attempt did not commit. */
-    readonly lifecycle: RecoveryCodeLifecycleState;
-    readonly reason: string;
-} | {
-    readonly kind: 'refused';
-    /** Unchanged: the code was never held by this attempt. */
-    readonly lifecycle: RecoveryCodeLifecycleState;
-    readonly code: RecoveryCodeTransitionRejection;
-    readonly reason: string;
-};
-/**
- * What the caller's activation work reports.
- *
- * `committed` is a claim that every required receipt verified — it is the
- * only thing that burns the code, so it must not be returned optimistically.
- */
-export type WalletRecoveryActivationResult<T> = {
-    readonly kind: 'committed';
-    readonly value: T;
-} | {
-    readonly kind: 'not_committed';
-    readonly reason: string;
-};
-export declare function runWalletRecoveryWithCode<T>(args: {
-    readonly lifecycle: RecoveryCodeLifecycleState;
-    readonly reservationId: RecoveryCodeReservationId;
-    readonly nowMs: number;
-    readonly reservationTtlMs: number;
-    /** Reads the clock again at commit time: activation is not instantaneous. */
-    readonly clockMs?: () => number;
-    readonly activate: () => Promise<WalletRecoveryActivationResult<T>>;
-}): Promise<WalletRecoveryAttemptOutcome<T>>;
-//# sourceMappingURL=recoveryCodeAttempt.d.ts.map

package/dist/types/wallet-server/src/core/AuthService.d.ts

@@ -1,3 +0,0 @@
-export { AuthService } from './authService/AuthService';
-export type { GoogleEmailOtpRegistrationOffer, GoogleEmailOtpRegistrationOfferCandidate, GoogleEmailOtpResolutionMode, GoogleEmailOtpResolutionResult, } from './authService/googleEmailOtpRegistration';
-//# sourceMappingURL=AuthService.d.ts.map

package/dist/types/wallet-server/src/core/NearPublicKeyStore.d.ts

@@ -1,48 +0,0 @@
-import type { NormalizedLogger } from './logger';
-import { type WebAuthnRpId } from '../../../shared-ts/src/utils/domainIds';
-import { type D1SchemaOptions, type D1TenantStoreOptions } from './d1TenantStore';
-export type NearPublicKeyKind = 'threshold' | 'local' | 'backup' | 'ephemeral';
-export type NearPublicKeyAuthBinding = {
-    readonly kind: 'passkey';
-    readonly rpId: WebAuthnRpId;
-    readonly credentialIdB64u: string;
-};
-export type NearPublicKeyRecord = {
-    version: 'near_public_key_v1';
-    userId: string;
-    publicKey: string;
-    kind: NearPublicKeyKind;
-    signerSlot?: number;
-    authBinding?: NearPublicKeyAuthBinding;
-    credentialIdB64u?: never;
-    rpId?: never;
-    createdAtMs: number;
-    updatedAtMs: number;
-    addedTxHash?: string;
-    removedAtMs?: number;
-};
-export interface NearPublicKeyStore {
-    put(record: NearPublicKeyRecord): Promise<void>;
-    listByUserId(userId: string): Promise<NearPublicKeyRecord[]>;
-}
-export interface D1NearPublicKeyStoreSchemaOptions extends D1SchemaOptions {
-}
-export interface D1NearPublicKeyStoreOptions extends D1TenantStoreOptions {
-}
-export declare const NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL: readonly ["\n    CREATE TABLE IF NOT EXISTS near_public_keys (\n      namespace TEXT NOT NULL,\n      org_id TEXT NOT NULL,\n      project_id TEXT NOT NULL,\n      env_id TEXT NOT NULL,\n      user_id TEXT NOT NULL,\n      public_key TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      signer_slot INTEGER,\n      record_json TEXT NOT NULL,\n      created_at_ms INTEGER NOT NULL,\n      updated_at_ms INTEGER NOT NULL,\n      removed_at_ms INTEGER,\n      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, public_key),\n      CHECK (length(user_id) > 0),\n      CHECK (length(public_key) > 0),\n      CHECK (kind IN ('threshold', 'local', 'backup', 'ephemeral')),\n      CHECK (signer_slot IS NULL OR signer_slot >= 1),\n      CHECK (json_valid(record_json)),\n      CHECK (created_at_ms > 0),\n      CHECK (updated_at_ms > 0),\n      CHECK (removed_at_ms IS NULL OR removed_at_ms > 0)\n    )\n  ", "\n    CREATE INDEX IF NOT EXISTS near_public_keys_user_idx\n      ON near_public_keys (\n        namespace,\n        org_id,\n        project_id,\n        env_id,\n        user_id,\n        signer_slot,\n        created_at_ms\n      )\n  "];
-export declare function ensureNearPublicKeyStoreD1Schema(options: D1NearPublicKeyStoreSchemaOptions): Promise<void>;
-/** A user's NEAR public keys, in signer-slot order; binds the scope, then the user. */
-export declare const NEAR_PUBLIC_KEYS_BY_USER_SQL = "SELECT record_json\n         FROM near_public_keys\n        WHERE namespace = ?\n          AND org_id = ?\n          AND project_id = ?\n          AND env_id = ?\n          AND user_id = ?\n        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC";
-export declare class D1NearPublicKeyStore implements NearPublicKeyStore {
-    readonly adapterKind = "d1";
-    private readonly table;
-    constructor(input: D1NearPublicKeyStoreOptions);
-    put(record: NearPublicKeyRecord): Promise<void>;
-    listByUserId(userId: string): Promise<NearPublicKeyRecord[]>;
-}
-export declare function createNearPublicKeyStore(input: {
-    config?: Record<string, unknown> | null;
-    logger: NormalizedLogger;
-    isNode: boolean;
-}): NearPublicKeyStore;
-//# sourceMappingURL=NearPublicKeyStore.d.ts.map